Security Weekly Podcast Network (Audio)

Special guest Joshua Wright joins us for a timely incident-response discussion!
Then, in the security news this week:
Have you heard about PHP2Shell?
Certificates with keys small enough to guess
Tor exit nodes turn into SSH credential traps
Do USB-C cables need firmware updates now?
HaleHound packs a radio lab into a cheap display
Claude solves part of the NIST curve mystery
The Army and self-directed offensive cyber agents
Retired nuclear reactors return to power AI
PatchSlop
NGINX, NODE.js patches critical flaws
BeyondTrust exploited before the patch landed
Plex vulnerabilities move from PoC to exploitation
ICS patches, including a Siemens flaw exploited in the wild
Can fake data trigger Japan’s emergency alert?
Agentic pentests?
AI may add noise more than skill
AI agents navigate OT and move equipment
AI model helps build a Chrome exploit
Utah’s VPN law runs into technical reality
Segment Resources:
https://dynamicincidentresponse.com/ - A New Era for Incident Response!
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-949

In this episode, Kriss Stephen, Principal Solutions Architect at Semperis, explores the concept of the Minimum Viable Company and the three foundational capabilities every organization needs to withstand and recover from a cyberattack. Drawing from his experience in identity security and cyber resilience, Kriss shares practical lessons on how organizations can prioritize recovery, protect critical identity systems, and maintain business operations during disruptive incidents. Listeners will gain actionable insights into building resilience before a breach occurs and accelerating recovery when it matters most.
This segment is sponsored by Semperis. Visit https://securityweekly.com/semperis to learn more about them!
In the leadership and communications segment, Crisis Communication for Boards handbook, Unclear AI risk ownership could leave CISOs in familiar scapegoat role, Optimism Is Now an Essential Leadership Skill, and more!
Visit https://www.securityweekly.com/bsw for all the latest episodes!
Show Notes: https://securityweekly.com/bsw-470

Klingons, Stop and Shop, OvHCloud, Microsoft, Plex2Shell, ReactOS, Aaran Leyland, and More on the Security Weekly News.
Visit https://www.securityweekly.com/swn for all the latest episodes!
Show Notes: https://securityweekly.com/swn-626

The OWAS Mobile Application Security (MAS) project recently released an updated version of its guidance, with excellent advice organized into common weaknesses, a verification standard for devs (MASVS), and a testing guide (MASTG). Ryan Lloyd and Jan Seredynski from Guardsquare dive into the project to talk about how it's been updated, how orgs can use it, and the challenges orgs face in managing their mobile frameworks and environments. We also cover how agents and LLMs are impacting mobile security and what future iterations of the MAS project might include for securing mobile apps interacting with LLMs or being written by LLMs. Finally, we share practical ways for developers to get involved as OWASP contributors and advocates.
Segment Resources:
https://mas.owasp.org
https://mas.owasp.org/MASWE/
https://hubs.ly/Q04ykvgm0
This segment is sponsored by Guardsquare. Visit https://securityweekly.com/guardsquare to learn more!
Visit https://www.securityweekly.com/asw for all the latest episodes!
Show Notes: https://securityweekly.com/asw-405

Interview with Michael Jenkins from ThreatLocker
Securing AI on the Endpoint - Zero Trust or Bust
Michael joins us for the first time to discuss strategies for securing the latest evolution of AI: local endpoint-based AI agents. Tools like Claude Code, OpenAI Codex, and Google AntiGravity give employees the power to build any software or workflow they can imagine, but what is the risk impact? These models aren't shy about adopting and downloading libraries, tools, and untrusted software to fulfill the goals they've been given.
We explore how execution control and ringfencing can add some sanity and security to the process.
This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!
Topic Segment: Anthropic Dreams of AI Replicants
Of all the things AI labs could be researching or cooking up, I wouldn't have guessed AI worms distributing inference across smart TVs would be on the list, but here we are. Adrian, Tyler, and Ayman mull over this strange research.
It is too loose to be an academic paper, but maybe should have been?
Is really a pressing AI risk we should be worried about right now?
Why did Anthropic choose to focus on smart TVs and not more powerful IoT devices?
Weekly Enterprise News
Finally, in the enterprise security news,
we discuss the vibes
certified organic books
don’t mess with criminals
the history of ShinyHunters
building strategies on the wrong lessons
crypto wallet supply chain drama
Hot refrigerators
Reddit is great for breach tracking
Microsoft patch Tuesday is on track to hit 12,000 patches by next April
All that and more, on this episode of Enterprise Security Weekly.
Visit https://www.securityweekly.com/esw for all the latest episodes!
Show Notes: https://securityweekly.com/esw-481